1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0

Analysis

max time kernel
7s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
Size 821KB
Sample261014-ncffzatwhy
SHA256 1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0
MD5 7a4486df17162e0846cc98e68c649a29
SHA1 5b4d666d9124a5f3cfc7724ccd5f75a3da7c2863
SHA512 7b9a858d64d919646c330cefc7e3aa341c17a47fb74d147d2f774bfa6d5db7f30bb900ffb9747334cb4a9e1ad43208db442aa0facbb5567280ce3741b013a039
SSDEEP 12288:D3qjokuvUA+RZMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Dnj+CSkQ/7Gb8NLEbeZ
TLSH
T13D058C1067F81019F2B36FB2AFFA89658A77BDB65A36D11F2214460F0A31E40D971B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4640	elevation_service.exe
1988	elevation_service.exe
1052	maintenanceservice.exe
2588	OSE.EXE
5936	PerceptionSimulationService.exe
3432	perfhost.exe
3584	ReFsDedupSvc.exe
3572	SensorDataService.exe
620	ssh-agent.exe
1856	AgentService.exe
3612	SearchIndexer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a949b7553a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	1844	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1844	1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
Token: SeTakeOwnershipPrivilege	4640	elevation_service.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3584	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1856	AgentService.exe
Token: 33	3612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3612	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 2800	3612	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe
"C:\Users\Admin\AppData\Local\Temp\1ae6e41eb55389ed99d2f48f1a4a5dd6568afd876d8cd0f68a2aa86fde8ae6e0.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 660
  2⤵
  - Program crash
  PID:4596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1844 -ip 1844
1⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ce9f83bdd4ba108ddcf1b2700bba6d96c4effeab5b69f8b19892ee8242c8a53f
MD5 b3bd5eede734ae4a5bae2283c586356b
SHA1 0fbf5c7580c9b4484c7cff10cdb624fa96a1f62c
SHA512 ad38014e8ec2b2c7ed74441c198390b3bb20eaa416a4cb1714a23981ece55121bb89616d9975aa8ddc0a555ddc43b6d679420da7f972e0a55f48d3750717da7a
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSkQ/qoLEw:j3q6HjBHqo4w
TLSH
T132D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 da6dc26361786cc1d5a1c39e9ce5e2a4c2effc26f30a71dc8e632be259a9ff27
MD5 a2106f52fc003cf6e0f664d26e621a7d
SHA1 29e1b17504e60640a501f0b9baa2fa18c5661a1a
SHA512 eafd7b814a4192c0dc18c674e4cafc086c08330dca0284a32e2c8a1d89bb26885a66b9ccc36390761c9bccdee1b380ad6ed77a2d3fa1c6b4eb61429e9ef46220
SSDEEP 12288:S1XLsswWkxy2lRq2czA9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:4XYfDtczAeSkQ/7Gb8NLEbeZ
TLSH
T12F05F12873E408FAEC67827DCCB28401EA7378954760F79B03E499665F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 64f24074283e512a448a9baa771154e2ca9c25706fabb620322946407ab52d91
MD5 af1f306c09f2cdb919bdb6c1e20c6a3f
SHA1 2c5b844bd4e51aa33d9c6ef53401826cbd80302d
SHA512 36add6790e6db225d6f0c10ced5e5437b26c31d3bffced5ea5f3a669a7cfd7921f15ad3bf10c3e96743a9c4e4028407d0c85693f7285c14294a070bbb642f4a8
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+CgMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:BwuoOWASkQ/7Gb8NLEbeZ
TLSH
T13105F14A72A40CFAE56746398597C431FBF2B8462A31DB2F1760C65B5F37211BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 11e597f2048687e91928209683e6db3e3e2fdb5d9c0a7b308510c064062ef545
MD5 2f8308f53eb06276b60535014596c3bf
SHA1 5ed8a579a335abd2176015ff73813260c7c80176
SHA512 5a2d7032460e070effb8be8a6e2f9986edee887a90ad1e7489e2a2e2ac94b2c3f00c3045289f0eca89e4a7472207b9b9f0341e56e4973813d5a59de3e975ca83
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3kQ/qoLEw:du6JmVxd2djqo4w
TLSH
T130D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 ef954efe6855dd6bf52e41ac8895c0473f8e7e5ad80225493482ccdcb91eeab8
MD5 cd71e15863b106848ae01fefa1d4c434
SHA1 f5b5ecde15376596fee00623185196b9e9bac77b
SHA512 67945422b531de753b548bf4786381a1534596c645c1bf0c2eb47430a3b66357fe7c99588085523792608d7c539a64c11cf7b5032828afe593bf04746ea4107c
SSDEEP 48:257fAKPRg1tPqRoctIVwXtIVwHIVwR+MPRg1tA:257YKpgHPcBtIVEIVEIVlMpgHA
TLSH
T1A7429E99FFD0D903D5A22434C9CEA3C87FA0DD5D5FD0136770CA721E5E246C1992E949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d5623c6f54542e48ed55fe69c43dc88e42f403622c410fec8339471a588e41ad
MD5 8190d470c2406f277777488c6cdab092
SHA1 12da1be9e8c0a8422319f36fa73f24c5d690e3a6
SHA512 e5ec23ec23f34d5a4db30dcdc08f453c25b5984fa83497aa7cac0fb8cfc6499ce737ef593bf81620f72463551ddbe60e60883cd1d8b551ff37df0eff73e18059
SSDEEP 12288:sz7gMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:aJSkQ/7Gb8NLEbeZ
TLSH
T1B3D42316A19804F3E0751F7118BD44101D6979CB4B30B5F7BE4CA26BAB7ACC8ECBB625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1d01702fe2dc6b333a43118256869a01171a7146acb70fa3e4508297c3240a1
MD5 d054c96a57f0f37c23a606d8e3e428f3
SHA1 1f4eed14bd4ba651dde5f34da05067a42a35b01f
SHA512 089b424ebdc51372ef512071a814fdebe8569331387c647813b045e5c801b2832255d92d5a8b5beb9a08ef0d61726916d3b767daa73bec6226b3831ce9dff1f7
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYzSkQ/7Gb8NLEbeZ:Hgb4mBIBhGFXkQ/qoLEw
TLSH
T19F659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5935bd881e654f030e021db6f53cd36c0bf8e4af6cd4f180b6d0eede747e15f3
MD5 46040c50953762706d9bed71febc7a71
SHA1 67b118c781635dba64c62bb7cb495ae9b12969ab
SHA512 26b67bff05914889604ac5ad9b7ade46c0cbc217a6ed9ea20e9b869650daae333ae818b62acb4541e2e9ac792fde3dcab00219f2ebd8b977f3a43ecde1551fe7
SSDEEP 24576:dG88u8FpJqH1bzria7/meSkQ/7Gb8NLEbeZ:w7ZFPqVea7/2kQ/qoLEw
TLSH
T18135F16572E001F1D47BD13889964663F6B2B4160324FBEF0BAC8B561F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 adbe96b7104eadba9cc23080f56c3b59d201263ad6ec29ad88b8c0c532a7d97b
MD5 305de0944a1a748b0ef83270601a24ea
SHA1 898600a3d689e7ebd572214c24f1ce0324545b6f
SHA512 a85c00a51253dee346e1ae89b2446854a3c1d38ed213c4582a94de7421145c463c78fb536b10a38a8c648c11189c399ed998b9d1db3ca173cb8d29fff9491f63
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDkQ/qoLEw:TG05lO43bgqo4w
TLSH
T103D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 78d3c923f97c79d1661fd5ab13a0b4af54350513543aa0079cc15cef84b45495
MD5 35c3ec76f0129ade3026599e1e59125a
SHA1 fafbb99baf39ad61b19a17589a76f25ccb4087e7
SHA512 27dfe65f5a4a657c05319c2b70f60ebb05765b415792e9f9622f0bccc22fead492bb3824efc7ebba5e226a9dd9ea86d1c8e7d7116ef97d14f508d03931f7a315
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncSkQ/7Gb8NLEbeZ:6a5POZ3+Jt2pasx2+mbkQ/qoLEw
TLSH
T1B065AF5EA2FC01D5D1B9D17DC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2e99fc2710daf31cd5afe4d7a93f36bfdffc08b3405a61d096b3d90cce05b5ce
MD5 f519fc73ba6c0a40c1ffc7a41f242d01
SHA1 5f8cbb1c2d1a19ba39e342499c2084f5283e2f2a
SHA512 4f5d988f682cf8d08fc298b6fc875960bc650a7ed08970a5792ca69a59dff6d9dd28dcbcefda02f3e723384577506e56759602bcb3bb35681f73b6a9f470072f
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkGSkQ/7Gb8NLEbeZ:BNc/zEOVHFWkQ/qoLEw
TLSH
T1A0858C1622E901E4F1BBE1BE89779546FAB1786913309ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9b9f0b56ea4383bd952086c05bb50559aea66174202430404b3bb941461afc61
MD5 983155bdf2af2dc5832f8f6c03e00397
SHA1 3a4d53368a73d2cc655d031fb9cd5ecf70e4baf7
SHA512 7ef75be8a630a5fecd71e04db30e9ca76e856b6b12f02a7930f0b80754ccd2c367afe95d4b06eb557c45b0dce4c0e077df112eb237921d6bab97177806634698
SSDEEP 24576:28kNvNnaFeYhJNtmZBmKSkQ/7Gb8NLEbeZ:28MwBtOmDkQ/qoLEw
TLSH
T19455AF6EB6B806E4D1FEC6B58D238512EA727461073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e8f0f596434b7765ea914081e85b87a864cab2a7d5354bb0977f0473d623d3c8
MD5 3bf32a233caeabd6e38383f49a2cd5ac
SHA1 496c670f01a9b8455a8face44dcca803c22267fc
SHA512 a6bf3bcbb0fadafe17c9b32bfbfc04eefc25d022b228a34078d5bfdd93734242168c1d8efbf02cd161d625b124696ea89d9eaa1aad8640ea55e6adeda84ed2dc
SSDEEP 12288:vHvUrBFrEjwaQXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:vPUr+NQ8SkQ/7Gb8NLEbeZ
TLSH
T1A005F12F62EC18E5E676A17D89964609F771B4520312A2DF02E0817F5F67DD8BC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-118-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/620-126-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/620-120-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/620-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1052-50-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1052-45-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1052-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1052-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1052-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1052-39-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1844-1-0x0000000000B10000-0x0000000000B76000-memory.dmp

Download

memory/1844-79-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

memory/1844-7-0x0000000000B10000-0x0000000000B76000-memory.dmp

Download

memory/1844-6-0x0000000000B10000-0x0000000000B76000-memory.dmp

Download

memory/1844-0-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

memory/1856-141-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1856-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1856-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1856-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1856-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1988-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1988-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1988-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1988-105-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2588-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2588-284-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2588-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2588-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2832-331-0x0000020B19170000-0x0000020B197F0000-memory.dmp

Download

memory/3432-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3432-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3432-83-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3432-89-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3572-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3572-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3572-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-113-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3572-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3584-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3584-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3584-334-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3584-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3584-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3612-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3612-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3612-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3612-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4640-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4640-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4640-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4640-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4640-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5936-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5936-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5936-299-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5936-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads